viio_trigger_alloc() initializes the device with device_initialize()
but uses kfree() directly in error paths, which bypasses the device's
release callback iio_trig_release(). This could lead to memory leaks
and inconsistent device state.

Additionally, the current error handling has the following issues:
1. Potential double-free of IRQ descriptors when kvasprintf fails.
2. The release function may attempt to free negative subirq_base.
3. Missing mutex_destroy in release function.

Fix these issues by:
1. Replacing kfree(trig) with put_device(&trig->dev) in error paths.
2. Setting subirq_base to 0 after freeing IRQ descriptors in error
path to prevent double-free in release callback.
3. Modifying release function to properly handle negative subirq_base.
4. Adding missing mutex_destroy().

Found by code review.

Cc: stable@vger.kernel.org
Fixes: 2c99f1a09da3 ("iio: trigger: clean up viio_trigger_alloc()")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
Changes in v2:
- modified the patch, thanks for developer's suggestions.
---
 drivers/iio/industrialio-trigger.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
index 54416a384232..9f6d30a244d9 100644
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -524,6 +524,7 @@ static void iio_trig_release(struct device *device)
 			       CONFIG_IIO_CONSUMERS_PER_TRIGGER);
 	}
 	kfree(trig->name);
+	mutex_destroy(&trig->pool_lock);
 	kfree(trig);
 }
 
@@ -596,8 +597,9 @@ struct iio_trigger *viio_trigger_alloc(struct device *parent,
 
 free_descs:
 	irq_free_descs(trig->subirq_base, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
+	trig->subirq_base = 0;
 free_trig:
-	kfree(trig);
+	put_device(&trig->dev);
 	return NULL;
 }
 
-- 
2.17.1

On Thu, Nov 06, 2025 at 04:29:23PM +0800, Ma Ke wrote:
> ---
> Changes in v2:
> - modified the patch, thanks for developer's suggestions.
> ---
>  drivers/iio/industrialio-trigger.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
> index 54416a384232..9f6d30a244d9 100644
> --- a/drivers/iio/industrialio-trigger.c
> +++ b/drivers/iio/industrialio-trigger.c
> @@ -524,6 +524,7 @@ static void iio_trig_release(struct device *device)
>  			       CONFIG_IIO_CONSUMERS_PER_TRIGGER);
>  	}
>  	kfree(trig->name);
> +	mutex_destroy(&trig->pool_lock);
>  	kfree(trig);
>  }
>  
> @@ -596,8 +597,9 @@ struct iio_trigger *viio_trigger_alloc(struct device *parent,
>  
>  free_descs:
>  	irq_free_descs(trig->subirq_base, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
> +	trig->subirq_base = 0;

This doesn't work.  Do it before the goto.

regards,
dan carpenter

>  free_trig:
> -	kfree(trig);
> +	put_device(&trig->dev);
>  	return NULL;
>  }
>  
> -- 
> 2.17.1

On Thu, 6 Nov 2025 18:16:06 +0300
Dan Carpenter <dan.carpenter@linaro.org> wrote:

> On Thu, Nov 06, 2025 at 04:29:23PM +0800, Ma Ke wrote:
> > ---
> > Changes in v2:
> > - modified the patch, thanks for developer's suggestions.
> > ---
> >  drivers/iio/industrialio-trigger.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
> > index 54416a384232..9f6d30a244d9 100644
> > --- a/drivers/iio/industrialio-trigger.c
> > +++ b/drivers/iio/industrialio-trigger.c
> > @@ -524,6 +524,7 @@ static void iio_trig_release(struct device *device)
> >  			       CONFIG_IIO_CONSUMERS_PER_TRIGGER);
> >  	}
> >  	kfree(trig->name);
> > +	mutex_destroy(&trig->pool_lock);
> >  	kfree(trig);
> >  }
> >  
> > @@ -596,8 +597,9 @@ struct iio_trigger *viio_trigger_alloc(struct device *parent,
> >  
> >  free_descs:
> >  	irq_free_descs(trig->subirq_base, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
> > +	trig->subirq_base = 0;  
> 
> This doesn't work.  Do it before the goto.

This is a bit ugly however we do it. Maybe should just call
device_initialize() to hand over to the reference counted version much later?
Just before return trig seems easiest spot to reason about.

That seems nicer than doing an irq_get_chip() in iio_trig_release() to figure
out if the first part of the if (trig->subirq_base) conditional block should run or not.

Adding a flag to the trig structure just to indicate we got to running
that loop also feels annoying but at least would ensure we could just do
a put_device() in here without the other handling above.

> 
> regards,
> dan carpenter
> 
> >  free_trig:
> > -	kfree(trig);
> > +	put_device(&trig->dev);
> >  	return NULL;
> >  }
> >  
> > -- 
> > 2.17.1

On Thu, Nov 06, 2025 at 04:29:23PM +0800, Ma Ke wrote:
> viio_trigger_alloc() initializes the device with device_initialize()
> but uses kfree() directly in error paths, which bypasses the device's
> release callback iio_trig_release(). This could lead to memory leaks
> and inconsistent device state.
> 
> Additionally, the current error handling has the following issues:
> 1. Potential double-free of IRQ descriptors when kvasprintf fails.

kvasprintf()

> 2. The release function may attempt to free negative subirq_base.
> 3. Missing mutex_destroy in release function.

mutex_destroy()

> Fix these issues by:
> 1. Replacing kfree(trig) with put_device(&trig->dev) in error paths.
> 2. Setting subirq_base to 0 after freeing IRQ descriptors in error
> path to prevent double-free in release callback.
> 3. Modifying release function to properly handle negative subirq_base.
> 4. Adding missing mutex_destroy().
> 
> Found by code review.

This is better now, but giving a nature of the issue and the fix I would really
appreciate some CIs and syzkaller (or alike) fuzzers to go with this first.

...

>  free_descs:
>  	irq_free_descs(trig->subirq_base, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
> +	trig->subirq_base = 0;

Why not getting rid of this label and accompanied code altogether?

-- 
With Best Regards,
Andy Shevchenko